IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
8.7Yüksek

CVE-2026-31837Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails.

istio istio; Red Hat Red Hat OpenShift AI 2.25; Red Hat Red Hat OpenShift Service Mesh 3.0; Red Hat Red Hat OpenShift Service Mesh 3.1 Yayım: (8 ay önce)

Açıklama

Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a user of Istio is impacted if the JWKS resolver becomes unavailable or the fetch fails, exposing hardcoded defaults regardless of use of the RequestAuthentication resource. This vulnerability is fixed in 1.29.1, 1.28.5, and 1.27.8.

Zayıflık türü (CWE): CWE-200CWE-1392

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
istio istio >= 1.29.0-alpha.0, < 1.29.1, >= 1.28.0-alpha.0, < 1.28.5, < 1.27.8
openshift ai 2.25 —
Red Hat cert-manager Operator for Red Hat OpenShift all versions
Red Hat ExternalDNS Operator —
Red Hat OpenShift Serverless all versions
Red Hat OpenShift Service Mesh 2 —
Red Hat OpenShift Service Mesh 3 —
Red Hat Red Hat Ansible Automation Platform 2 —
Red Hat Red Hat Connectivity Link 1 —
Red Hat Red Hat OpenShift AI 2.25 all versions
Red Hat Red Hat OpenShift AI (RHOAI) all versions
Red Hat Red Hat OpenShift Service Mesh 3.0 all versions
Red Hat Red Hat OpenShift Service Mesh 3.1 all versions
Red Hat Red Hat OpenShift Service Mesh 3.2 all versions
service mesh 3.0 —
service mesh 3.1 —
service mesh 3.2 —

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (3)
  • cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:* < 1.27.8
  • cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:* ≥ 1.28.0 < 1.28.5
  • cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:* ≥ 1.29.0 < 1.29.1